Herley's analysis suggests the scam works because it quickly passes BS-detection thresholds in most readers, but those stupid enough to fall for the scam self-select by responding. Scammers end up with a list of hot prospects who have self-selected, leaving them with less work to cash in than would be required with a more plausible tale.

“An email with tales of fabulous amounts of money and West African corruption will strike all but the most gullible as bizarre,” he writes. “It will be recognized and ignored by anyone who has been using the Internet long enough to have seen it several times. It will be ﬁgured out by anyone savvy enough to use a search engine [and] won’t be pursued by anyone who consults sensible family or ﬁends [that's Microsoft's typo], or who reads any of the advice banks and money transfer agencies make available.”

“Those who remain are the scammers ideal targets,” the paper proclaims, as “A less outlandish wording that did not mention Nigeria would almost certainly gather more total responses and more viable responses, but would yield lower overall proﬁt.”

There's a serious side to all this, as the main thrust of Herley's research is how false positives are used by folks with more evil intent than Nigerian scammers to design other forms of attack. He therefore suggests “thinking like an attacker does not end when a hole is found, but must continue (as an attacker would continue) in determining how the hole can be monetized.” ®